[docker-orchagent] limit privileged flag for swss container

[maipbui]

Why I did it

HLD implementation: Container Hardening (sonic-net/SONiC#1364)

Work item tracking

• Microsoft ADO (number only): 14807420

How I did it

Reduce linux capabilities in privileged flag

How to verify it

Check container's settings: Privileged is false and container only has default Linux caps, and NET_ADMIN cap.

admin@vlab-01:~$ docker inspect swss | grep Privi
            "Privileged": false,


admin@vlab-01:~$ docker exec -it swss bash
root@vlab-01:/# capsh --print
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_net_admin,cap_audit_write,cap_setfcap=ep

Which release branch to backport (provide reason below if selected)

• 201811
• 201911
• 202006
• 202012
• 202106
• 202111
• 202205
• 202211
• 202305

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[maipbui]

/azpw run Azure.sonic-buildimage

[mssonicbld]

/AzurePipelines run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[maipbui]

/azpw run Azure.sonic-buildimage

[mssonicbld]

/AzurePipelines run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[maipbui]

--security-opt apparmor=unconfined --security-opt="systempaths=unconfined"

These arguments are necessary for arp/test_arp_extended.py test case

arp/test_arp_extended.py:95: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
/usr/local/lib/python3.8/dist-packages/ptf/testutils.py:3250: in verify_packet
    test.fail(
        device     = 0
        pkt        = <Ether  dst=b'fe:54:00:a3:80:01' src=22:48:23:27:33:d8 type=ARP |<ARP  op=is-at hwsrc=22:48:23:27:33:d8 psrc=192.168.0...:a3:80:01' pdst=192.168.0.3 |<Raw  load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>
        port       = 1
        port_id    = 1
        result     = PollFailure(device=None, port=None, packet=None, time=None)
        test       = <tests.common.plugins.ptfadapter.ptfadapter.PtfTestAdapter testMethod=runTest>
        timeout    = 10
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.common.plugins.ptfadapter.ptfadapter.PtfTestAdapter testMethod=runTest>
msg = 'Expected packet was not received on device 0, port 1.\n========== EXPECTED ==========\ndst        : DestMACField     ...00 00 00              ............\n========== RECEIVED ==========\n0 total packets.\n==============================\n'

    def fail(self, msg=None):
        """Fail immediately, with the given message."""
>       raise self.failureException(msg)
E       AssertionError: Expected packet was not received on device 0, port 1.
E       ========== EXPECTED ==========
E       dst        : DestMACField                        = b'fe:54:00:a3:80:01' ('None')
E       src        : SourceMACField                      = '22:48:23:27:33:d8' ('None')
E       type       : XShortEnumField                     = 2054            ('36864')
E       --
E       hwtype     : XShortEnumField                     = 1               ('1')
E       ptype      : XShortEnumField                     = 2048            ('2048')
E       hwlen      : FieldLenField                       = None            ('None')
E       plen       : FieldLenField                       = None            ('None')
E       op         : ShortEnumField                      = 2               ('1')
E       hwsrc      : MultipleTypeField (SourceMACField, StrFixedLenField) = '22:48:23:27:33:d8' ('None')
E       psrc       : MultipleTypeField (SourceIPField, SourceIP6Field, StrFixedLenField) = '192.168.0.4'   ('None')
E       hwdst      : MultipleTypeField (MACField, StrFixedLenField) = b'fe:54:00:a3:80:01' ('None')
E       pdst       : MultipleTypeField (IPField, IP6Field, StrFixedLenField) = '192.168.0.3'   ('None')
E       --
E       load       : StrField                            = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' ("b''")
E       --
E       0000  FE 54 00 A3 80 01 22 48 23 27 33 D8 08 06 00 01  .T...."H#'3.....
E       0010  08 00 06 04 00 02 22 48 23 27 33 D8 C0 A8 00 04  ......"H#'3.....
E       0020  FE 54 00 A3 80 01 C0 A8 00 03 00 00 00 00 00 00  .T..............
E       0030  00 00 00 00 00 00 00 00 00 00 00 00              ............
E       ========== RECEIVED ==========
E       0 total packets.
E       ==============================
``` #Closed

[maipbui]

@prsunny can you help review?

[prsunny]

lgtm on the plan for reducing previlege. Do you know what functionalities would be limited due to this change?

[maipbui]

@prsunny All capabilities mentioned in this table except for NET_ADMIN will be disabled https://github.com/sonic-net/SONiC/blob/master/doc/Container%20Hardening/SONiC_container_hardening_HLD.md#table-4-extended-linux-capabilities